Deutsche Bank (Malaysia) Berhad

The domain has at least one IPv6 address (AAAA DNS record). This is the fundamental requirement for IPv6 connectivity.

✗ No AAAA record found in DNS.

The IPv6 addresses are publicly routable — not link-local (fe80::/10), Unique Local Addresses (fc00::/7), loopback (::1) or documentation ranges (2001:db8::/32).

✗ IPv6 address is not globally routable (link-local, ULA or loopback).

The website is reachable on port 80 (HTTP) when connecting via IPv6. Tests direct IPv6 HTTP connectivity.

✗ HTTP (port 80) is not accessible over IPv6.

The website is reachable on port 443 (HTTPS) when connecting via IPv6. Verifies secure IPv6 web access.

✗ HTTPS (port 443) is not accessible over IPv6.

The authoritative DNS nameservers for this domain have their own AAAA records and are reachable over IPv6 on port 53. Required for a fully IPv6-capable DNS chain.

✗ No authoritative nameserver is reachable over IPv6.

DNSSEC (Domain Name System Security Extensions) is enabled. This cryptographically signs DNS responses, preventing cache poisoning and spoofing. Worth 2 points due to its importance for DNS security.

✗ DNSSEC validation failed — zone is unsigned or chain of trust is broken.

A PTR (pointer) record exists in the ip6.arpa zone for the domain's IPv6 address. Reverse DNS is important for mail delivery, logging and network diagnostics.

✗ No PTR record found. Reverse DNS lookup failed.

The domain supports both IPv4 (A record) and IPv6 (AAAA record). Dual-stack operation is recommended during the IPv6 transition period to ensure backwards compatibility.

✗ Domain is IPv6-only — no A record found.

The server advertises HTTP/3 (QUIC) support via the Alt-Svc: h3 response header. HTTP/3 runs over QUIC, which is UDP-based and natively IPv6-friendly.

✗ No HTTP/3 advertisement found (Alt-Svc: h3 header not present).

Full chain-of-trust validation using delv. Confirms that DNSKEY, RRSIG and DS records form a valid trust chain from the root.

✗ Validation failed — zone is unsigned or chain of trust is broken.

A Delegation Signer (DS) record exists in the parent zone, anchoring the DNSSEC trust chain.

✗ No DS record at parent — DNSSEC chain cannot be established.

RRSIG signatures are present on SOA records and have not expired.

✗ No valid RRSIG found — signatures missing or expired.

The cryptographic algorithm used for DNSSEC signing (from the KSK DNSKEY record).

No DNSKEY record found.